SAP Patches Critical 9.9 CVSS NetWeaver ABAP Vulnerability
High-risk flaw exposing data security has been addressed in latest updates.
1Critical Vulnerability Discovered
SAP addressed a critical vulnerability (CVE-2026-44747, CVSS 9.9) in NetWeaver Application Server ABAP as part of July 2026 security updates. This out-of-bounds write flaw allows authenticated attackers to exploit logical errors in memory management, potentially leading to unauthorized data access or modification.
2Temporary Workaround
Security firm Onapsis suggested temporarily disabling specific ICF nodes as an interim solution. However, this workaround prevents opening transactions in SAP GUI for HTML, making it unsuitable for all customers. Experts strongly recommend installing the patched ABAP Kernel version for comprehensive protection.
3Additional Critical Fixes
SAP also patched two other critical vulnerabilities: CVE-2026-27690 allows HTTP request/response smuggling in non-Cloud Foundry environments, while CVE-2026-44761 involves default credentials in SAP Commerce Cloud that could enable attackers to read and modify data through certain APIs.
4Sample Configuration Risk
The vulnerability originated from sample configuration scripts previously provided in SAP Help Portal. These scripts, meant for development/testing, configured OAuth 2.0 clients with hard-coded credentials. Older documentation versions didn't explicitly warn against using these default settings in production environments.
5Unaffected Customers
Customers who removed the sample client or replaced the default secret with a strong, unique value aren't impacted. SAP recommends auditing production environments for the presence of the affected OAuth 2.0 client and removing it if found to ensure system security.
6Update Imperative
While there's no evidence of active exploitation, applying these updates is crucial for maintaining system security. The patches are particularly vital for industries like finance and healthcare where operational continuity and data integrity are paramount concerns.
Original article: The Hacker News — SAP NetWeaver ABAP'ta Kritik Güvenlik Açığı Düzeltildi